topic Re: Why would an active firewall in an active-passive HA configuration broadcast gratuitous ARPs every 60 seconds? in Next-Generation Firewall Discussions

Why would an active firewall in an active-passive HA configuration broadcast gratuitous ARPs every 60 seconds?

A.Leung514385 — Tue, 21 Apr 2026 02:32:06 GMT

I found a KB article stating that the active firewall sends out gratuitous ARPs every 60 seconds during normal operation, but it doesn't explain why. What is the reason for this behaviour?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004Ny3CAE

Re: Why would an active firewall in an active-passive HA configuration broadcast gratuitous ARPs every 60 seconds?

oliwer96pety — Tue, 21 Apr 2026 11:04:42 GMT

In an active–passive high availability firewall setup, the active firewall may broadcast gratuitous ARPs every 60 seconds as a way to continuously assert its ownership of the virtual IP address and keep network devices updated. Gratuitous ARP messages help ensure that switches, routers, and connected hosts maintain the correct MAC-to-IP mapping in their ARP tables, preventing stale or incorrect entries that could disrupt traffic flow. This periodic broadcasting is especially useful in environments where ARP table entries might age out or where there is a risk of failover events, as it reinforces network stability and minimizes packet loss or misrouting by reminding all devices that the active firewall is still responsible for handling traffic.

Re: Why would an active firewall in an active-passive HA configuration broadcast gratuitous ARPs every 60 seconds?

kiwi — Fri, 24 Apr 2026 07:24:26 GMT

Hi @A.Leung514385 ,

It is just way of telling the switch that the current active is still the one active (liveliness check), because switches have timer associated with the CAM entries.

Kind regards,

Re: Why would an active firewall in an active-passive HA configuration broadcast gratuitous ARPs every 60 seconds?

A.Leung514385 — Fri, 24 Apr 2026 09:02:20 GMT

Hi @kiwi ,

Thanks for your response

Regards,